From: David Miller <davem@davemloft.net> Date: 2011-03-21 02:51:21
1) The R8169 PHY fix from Eric Dumazet, which I see you've added to
your tree too. :-)
2) NIU driver broken by OF layer changes, fix by eliminating platform
device name conflict.
3) Fix VHOST receive queue locking, from Michael S. Tsirkin.
4) Some gianfar chips are buggy wrt. checksums for certain packet
buffer alignments, fall back to sw checksumming in those cases.
From Alex Dubov.
5) ECONET leaks 4 uninitialized bytes to the network, fix from Vasiliy
Kulikov.
6) Fix blind deref of ethtool_ops->set_sg(), fix from Roger Luethi.
7) ethtool_rxnfc needs syscall compat handling, from Ben Hutchings.
8) VLAN broken over gre tunnels because it does not take
->needed_headroom into account. Fix from Eric Dumazet.
9) Bridging netfilter needs to init IPCB() of skb before injecting
packet into the IP stack, fix from Herbert Xu.
10) ftmac100 has off-by-one error, fix by using resource_size(). Fix
from Dan Carpenter.
11) IPSET fixes from Jozsef Kadlecsik.
12) Netfilter xtables has some reentrancy issues, fix from Eric Dumazet.
13) CLUSTERIP netfilter iptablesm module needs to check user buffer size
more carefully, fix from Vasiliy Kulikov.
Please pull, thanks a lot!
The following changes since commit a44f99c7efdb88fa41128065c9a9445c19894e34:
Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 (2011-03-20 18:14:55 -0700)
are available in the git repository at:
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6.git master
Alex Dubov (1):
gianfar: Fall back to software tcp/udp checksum on older controllers
Ben Hutchings (1):
ethtool: Compat handling for struct ethtool_rxnfc
Dan Carpenter (1):
ftmac100: use resource_size()
David S. Miller (3):
niu: Rename NIU parent platform device name to fix conflict.
Merge branch 'master' of git://git.kernel.org/.../kaber/nf-2.6
Merge branch 'vhost-net-next' of git://git.kernel.org/.../mst/vhost
Eric Dumazet (3):
vlan: should take into account needed_headroom
r8169: fix a bug in rtl8169_init_phy()
netfilter: xtables: fix reentrancy
Herbert Xu (1):
bridge: Reset IPCB when entering IP stack on NF_FORWARD
Jason Wang (3):
vhost-net: check the support of mergeable buffer outside the receive loop
vhost-net: Unify the code of mergeable and big buffer handling
vhost: lock receive queue, not the socket
Jozsef Kadlecsik (2):
netfilter: ipset: fix address ranges at hash:*port* types
netfilter: ipset: fix checking the type revision at create command
Krishna Kumar (1):
vhost: Cleanup vhost.c and net.c
Michael S. Tsirkin (2):
vhost: copy_from_user -> __copy_from_user
vhost-net: remove unlocked use of receive_queue
Mike Frysinger (1):
headers: use __aligned_xx types for userspace
Nicolas de Pesloüan (1):
bonding: fix a typo in a comment
Roger Luethi (1):
ethtool: __ethtool_set_sg: check for function pointer before using it
Vasiliy Kulikov (2):
econet: 4 byte infoleak to the network
netfilter: ipt_CLUSTERIP: fix buffer overflow
drivers/net/bonding/bond_main.c | 2 +-
drivers/net/ftmac100.c | 2 +-
drivers/net/gianfar.c | 16 ++-
drivers/net/gianfar.h | 1 +
drivers/net/niu.c | 2 +-
drivers/net/r8169.c | 4 +-
drivers/vhost/net.c | 159 ++++--------------------
drivers/vhost/vhost.c | 55 ++++++---
include/linux/ethtool.h | 34 +++++
include/linux/if_ppp.h | 16 ++--
include/linux/netfilter/ipset/ip_set_getport.h | 10 ++
include/linux/netfilter/nfnetlink_log.h | 4 +-
include/linux/netfilter/nfnetlink_queue.h | 4 +-
include/linux/netfilter/xt_connbytes.h | 4 +-
include/linux/netfilter/xt_quota.h | 2 +-
net/8021q/vlan_dev.c | 1 +
net/bridge/br_netfilter.c | 3 +
net/core/ethtool.c | 3 +
net/econet/af_econet.c | 2 +-
net/ipv4/netfilter/ip_tables.c | 4 +-
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +-
net/ipv6/netfilter/ip6_tables.c | 4 +-
net/netfilter/ipset/ip_set_core.c | 22 +++-
net/netfilter/ipset/ip_set_hash_ipport.c | 34 ++----
net/netfilter/ipset/ip_set_hash_ipportip.c | 34 ++----
net/netfilter/ipset/ip_set_hash_ipportnet.c | 34 ++----
net/netfilter/ipset/ip_set_hash_netport.c | 30 ++----
net/socket.c | 114 ++++++++++++++++-
28 files changed, 321 insertions(+), 284 deletions(-)
From: Eric Dumazet <hidden> Date: 2011-03-21 13:32:48
Le lundi 21 mars 2011 à 13:53 +0100, Ingo Molnar a écrit :
Dave,
lockdep caught this held-lock-freed incident in the networking code:
[ 21.121321] EXT3-fs (sda5): using internal journal
[ 21.127218] EXT3-fs (sda5): mounted filesystem with ordered data mode
[ 22.034265] rc.sysinit used greatest stack depth: 5796 bytes left
[ 22.511213] IPv4 FIB: Using LC-trie version 0.409
[ 22.646483]
[ 22.646484] =========================
[ 22.648398] [ BUG: held lock freed! ]
[ 22.648398] -------------------------
[ 22.648398] ifconfig/329 is freeing memory f5d01680-f5d018ff, with a lock still held there!
[ 22.648398] (sk_lock-AF_IPX){......}, at: [<c1c345b1>] ipx_release+0x21/0xf0
[ 22.648398] 1 lock held by ifconfig/329:
[ 22.648398] #0: (sk_lock-AF_IPX){......}, at: [<c1c345b1>] ipx_release+0x21/0xf0
[ 22.648398]
[ 22.648398] stack backtrace:
[ 22.648398] Pid: 329, comm: ifconfig Not tainted 2.6.38-tip+ #109381
[ 22.648398] Call Trace:
[ 22.648398] [<c1d3dd48>] ? printk+0x2d/0x2f
[ 22.648398] [<c1067aab>] debug_check_no_locks_freed+0x10b/0x130
[ 22.648398] [<c10eae01>] kmem_cache_free+0x61/0x120
[ 22.648398] [<c1b1135c>] ? __sk_free+0xbc/0x150
[ 22.648398] [<c1b1135c>] __sk_free+0xbc/0x150
[ 22.648398] [<c1b17964>] ? skb_dequeue+0x44/0x60
[ 22.648398] [<c1b11ee5>] sk_free+0x25/0x30
[ 22.648398] [<c1c34647>] ipx_release+0xb7/0xf0
[ 22.648398] [<c1b0e386>] sock_release+0x16/0x60
[ 22.648398] [<c1b0e3e5>] sock_close+0x15/0x30
[ 22.648398] [<c1b0e3d0>] ? sock_close+0x0/0x30
[ 22.648398] [<c10f33cc>] fput+0xcc/0x260
[ 22.648398] [<c10f112a>] filp_close+0x4a/0x80
[ 22.648398] [<c103a7c6>] put_files_struct+0x146/0x170
[ 22.648398] [<c103a6b0>] ? put_files_struct+0x30/0x170
[ 22.648398] [<c103a87c>] exit_files+0x3c/0x50
[ 22.648398] [<c103abac>] do_exit+0x10c/0x770
[ 22.648398] [<c10f1d50>] ? vfs_write+0xf0/0x160
[ 22.648398] [<c10f1b80>] ? do_sync_write+0x0/0xe0
[ 22.648398] [<c103b284>] do_group_exit+0x34/0x90
[ 22.648398] [<c103b2f8>] sys_exit_group+0x18/0x20
[ 22.648398] [<c1d52597>] sysenter_do_call+0x12/0x32
Not sure whether it's VFS or networking related - my guess it's the latter.
The bug was introduced between 016aa2ed1cc9 and a44f99c7efdb.
The box has booted up fine after the lockdep report. Config attached.
Hi Ingo, thanks for this report.
Here is a probable fix.
[PATCH] ipx: fix ipx_release()
Commit b0d0d915d1d1a0 (remove the BKL) added a regression, because
sock_put() can free memory while we are going to use it later.
Fix is to delay sock_put() _after_ release_sock().
Reported-by: Ingo Molnar <redacted>
Signed-off-by: Eric Dumazet <redacted>
Cc: Arnd Bergmann <arnd@arndb.de>
---
net/ipx/af_ipx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[PATCH] ipx: fix ipx_release()
Commit b0d0d915d1d1a0 (remove the BKL) added a regression, because
sock_put() can free memory while we are going to use it later.
Fix is to delay sock_put() after release_sock().
Reported-by: Ingo Molnar <redacted>
Signed-off-by: Eric Dumazet <redacted>
Cc: Arnd Bergmann <arnd@arndb.de>
Your fix looks good, thanks Eric!
Acked-by: Arnd Bergmann <arnd@arndb.de>
I believe I made the same mistake in atalk_release and x25_release:
8<------------
net: fix atalk_release and x25_release
The recent BKL removal has introduced a use-after-free problem
in multiple network protocols. This fixes the problem in appletalk
and x25 by ensuring that we call the final sock_put() after
releasing the socket lock.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
From: Eric Dumazet <hidden> Date: 2011-03-21 14:56:19
Le lundi 21 mars 2011 à 15:50 +0100, Arnd Bergmann a écrit :
On Monday 21 March 2011, Eric Dumazet wrote:
quoted
[PATCH] ipx: fix ipx_release()
Commit b0d0d915d1d1a0 (remove the BKL) added a regression, because
sock_put() can free memory while we are going to use it later.
Fix is to delay sock_put() after release_sock().
Reported-by: Ingo Molnar <redacted>
Signed-off-by: Eric Dumazet <redacted>
Cc: Arnd Bergmann <arnd@arndb.de>
Your fix looks good, thanks Eric!
Acked-by: Arnd Bergmann <arnd@arndb.de>
I believe I made the same mistake in atalk_release and x25_release:
8<------------
net: fix atalk_release and x25_release
The recent BKL removal has introduced a use-after-free problem
in multiple network protocols. This fixes the problem in appletalk
and x25 by ensuring that we call the final sock_put() after
releasing the socket lock.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
@@ -669,8 +669,8 @@ static int x25_release(struct socket *sock)sock_orphan(sk);out:-release_sock(sk);sock_put(sk);+release_sock(sk);return0;}
Hmm, x25_release() looks fine, I believe no fix is needed.
D'oh. You're right of course. My patch would introduce the bug,
not fix it. Updated patch below.
Arnd
8<-------------------------
net/appletalk: fix atalk_release use after free
The BKL removal in appletalk introduced a use-after-free problem,
where atalk_destroy_socket frees a sock, but we still release
the socket lock on it.
An easy fix is to take an extra reference on the sock and sock_put
it when returning from atalk_release.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
index 3d4f4b0..206e771 100644
@@ -669,8 +669,8 @@ static int x25_release(struct socket *sock)sock_orphan(sk);out:-release_sock(sk);sock_put(sk);+release_sock(sk);return0;}
Hmm, x25_release() looks fine, I believe no fix is needed.
D'oh. You're right of course. My patch would introduce the bug,
not fix it. Updated patch below.
Arnd
8<-------------------------
net/appletalk: fix atalk_release use after free
The BKL removal in appletalk introduced a use-after-free problem,
where atalk_destroy_socket frees a sock, but we still release
the socket lock on it.
An easy fix is to take an extra reference on the sock and sock_put
it when returning from atalk_release.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
index 3d4f4b0..206e771 100644
From: Eric Dumazet <hidden> Date: 2011-03-21 18:09:12
Le lundi 21 mars 2011 à 18:39 +0100, Ingo Molnar a écrit :
here's the same but with kallsyms enabled.
Thanks,
Ingo
[ 9.585627] initcall 0xffffffff81d5b806 returned 0 after 0 usecs
[ 9.588960] calling 0xffffffff81d5b9da @ 1
[ 9.592303] IPVS: Creating netns size=1272 id=0
[ 9.595646] IPVS: __ip_vs_control_init(): alloc_percpu.
[ 9.602298] IPVS: cannot register namespace.
[ 9.605627] IPVS: can't setup control
It seems IPVS is busted in case of memory allocation error in
__ip_vs_control_init()
IPVS deinits its "struct netns_ipvs" space, but something (in IPVS) uses
it after free.
__ip_vs_init() seems to be called before ip_vs_init() completes
correctly. We then keep in net->ipvs a pointer to some freed memory.
Commit 14e405461e664b7 did some changes in this area
Simon, any idea ?
On Sun, Mar 20, 2011 at 7:51 PM, David Miller [off-list ref] wrote:
1) The R8169 PHY fix from Eric Dumazet, which I see you've added to
your tree too. :-)
Yeah, since my machine didn't have networking without it, and I could
test it myself, I didn't wait to pull.
That said, I'm delaying this pull request due to the known issues with
it - let me know when you've updated it with the fix for the
use-after-free fixes and the slab corruptor (the latter of which I
haven't seen a patch for yet)
Linus
From: Eric Dumazet <hidden> Date: 2011-03-21 20:11:05
Le lundi 21 mars 2011 à 12:24 -0700, Linus Torvalds a écrit :
On Sun, Mar 20, 2011 at 7:51 PM, David Miller [off-list ref] wrote:
quoted
1) The R8169 PHY fix from Eric Dumazet, which I see you've added to
your tree too. :-)
Yeah, since my machine didn't have networking without it, and I could
test it myself, I didn't wait to pull.
That said, I'm delaying this pull request due to the known issues with
it - let me know when you've updated it with the fix for the
use-after-free fixes and the slab corruptor (the latter of which I
haven't seen a patch for yet)
Seems to be related to one typo, but still we have to find the
corruption
From: Eric Dumazet <hidden> Date: 2011-03-21 20:16:38
Le lundi 21 mars 2011 à 19:07 +0100, Eric Dumazet a écrit :
Le lundi 21 mars 2011 à 18:39 +0100, Ingo Molnar a écrit :
quoted
here's the same but with kallsyms enabled.
Thanks,
Ingo
[ 9.585627] initcall 0xffffffff81d5b806 returned 0 after 0 usecs
[ 9.588960] calling 0xffffffff81d5b9da @ 1
[ 9.592303] IPVS: Creating netns size=1272 id=0
[ 9.595646] IPVS: __ip_vs_control_init(): alloc_percpu.
[ 9.602298] IPVS: cannot register namespace.
[ 9.605627] IPVS: can't setup control
It seems IPVS is busted in case of memory allocation error in
__ip_vs_control_init()
IPVS deinits its "struct netns_ipvs" space, but something (in IPVS) uses
it after free.
__ip_vs_init() seems to be called before ip_vs_init() completes
correctly. We then keep in net->ipvs a pointer to some freed memory.
Commit 14e405461e664b7 did some changes in this area
Simon, any idea ?
For the time being, we can avoid the false memory allocation error (and
leak)
Thanks
[PATCH] ipvs: fix a typo in __ip_vs_control_init()
Reported-by: Ingo Molnar <redacted>
Signed-off-by: Eric Dumazet <redacted>
Cc: Simon Horman <horms@verge.net.au>
Cc: Julian Anastasov <ja@ssi.bg>
---
net/netfilter/ipvs/ip_vs_ctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Simon Horman <horms@verge.net.au> Date: 2011-03-21 22:14:11
On Mon, Mar 21, 2011 at 09:15:40PM +0100, Eric Dumazet wrote:
Le lundi 21 mars 2011 à 19:07 +0100, Eric Dumazet a écrit :
quoted
Le lundi 21 mars 2011 à 18:39 +0100, Ingo Molnar a écrit :
quoted
here's the same but with kallsyms enabled.
Thanks,
Ingo
[ 9.585627] initcall 0xffffffff81d5b806 returned 0 after 0 usecs
[ 9.588960] calling 0xffffffff81d5b9da @ 1
[ 9.592303] IPVS: Creating netns size=1272 id=0
[ 9.595646] IPVS: __ip_vs_control_init(): alloc_percpu.
[ 9.602298] IPVS: cannot register namespace.
[ 9.605627] IPVS: can't setup control
It seems IPVS is busted in case of memory allocation error in
__ip_vs_control_init()
IPVS deinits its "struct netns_ipvs" space, but something (in IPVS) uses
it after free.
__ip_vs_init() seems to be called before ip_vs_init() completes
correctly. We then keep in net->ipvs a pointer to some freed memory.
Commit 14e405461e664b7 did some changes in this area
Simon, any idea ?
For the time being, we can avoid the false memory allocation error (and
leak)
Sorry, that typo is my work.
Thanks
[PATCH] ipvs: fix a typo in __ip_vs_control_init()
Reported-by: Ingo Molnar <redacted>
Signed-off-by: Eric Dumazet <redacted>
Cc: Simon Horman <horms@verge.net.au>
Cc: Julian Anastasov <ja@ssi.bg>
From: Simon Horman <horms@verge.net.au> Date: 2011-03-21 23:29:34
On Tue, Mar 22, 2011 at 07:13:58AM +0900, Simon Horman wrote:
On Mon, Mar 21, 2011 at 09:15:40PM +0100, Eric Dumazet wrote:
quoted
Le lundi 21 mars 2011 à 19:07 +0100, Eric Dumazet a écrit :
quoted
Le lundi 21 mars 2011 à 18:39 +0100, Ingo Molnar a écrit :
quoted
here's the same but with kallsyms enabled.
Thanks,
Ingo
[ 9.585627] initcall 0xffffffff81d5b806 returned 0 after 0 usecs
[ 9.588960] calling 0xffffffff81d5b9da @ 1
[ 9.592303] IPVS: Creating netns size=1272 id=0
[ 9.595646] IPVS: __ip_vs_control_init(): alloc_percpu.
[ 9.602298] IPVS: cannot register namespace.
[ 9.605627] IPVS: can't setup control
It seems IPVS is busted in case of memory allocation error in
__ip_vs_control_init()
IPVS deinits its "struct netns_ipvs" space, but something (in IPVS) uses
it after free.
__ip_vs_init() seems to be called before ip_vs_init() completes
correctly. We then keep in net->ipvs a pointer to some freed memory.
Commit 14e405461e664b7 did some changes in this area
Simon, any idea ?
For the time being, we can avoid the false memory allocation error (and
leak)
From: Simon Horman <horms@verge.net.au> Date: 2011-03-22 00:01:44
On Tue, Mar 22, 2011 at 08:29:21AM +0900, Simon Horman wrote:
On Tue, Mar 22, 2011 at 07:13:58AM +0900, Simon Horman wrote:
quoted
On Mon, Mar 21, 2011 at 09:15:40PM +0100, Eric Dumazet wrote:
quoted
Le lundi 21 mars 2011 à 19:07 +0100, Eric Dumazet a écrit :
quoted
Le lundi 21 mars 2011 à 18:39 +0100, Ingo Molnar a écrit :
quoted
here's the same but with kallsyms enabled.
Thanks,
Ingo
[ 9.585627] initcall 0xffffffff81d5b806 returned 0 after 0 usecs
[ 9.588960] calling 0xffffffff81d5b9da @ 1
[ 9.592303] IPVS: Creating netns size=1272 id=0
[ 9.595646] IPVS: __ip_vs_control_init(): alloc_percpu.
[ 9.602298] IPVS: cannot register namespace.
[ 9.605627] IPVS: can't setup control
It seems IPVS is busted in case of memory allocation error in
__ip_vs_control_init()
IPVS deinits its "struct netns_ipvs" space, but something (in IPVS) uses
it after free.
__ip_vs_init() seems to be called before ip_vs_init() completes
correctly. We then keep in net->ipvs a pointer to some freed memory.
Commit 14e405461e664b7 did some changes in this area
Simon, any idea ?
For the time being, we can avoid the false memory allocation error (and
leak)
@@ -43,11 +43,6 @@ EXPORT_SYMBOL(register_ip_vs_app);EXPORT_SYMBOL(unregister_ip_vs_app);EXPORT_SYMBOL(register_ip_vs_app_inc);-/* ipvs application list head */-staticLIST_HEAD(ip_vs_app_list);-staticDEFINE_MUTEX(__ip_vs_app_mutex);--/**Getanip_vs_appobject*/
From: Simon Horman <horms@verge.net.au> Date: 2011-03-22 00:17:14
On Tue, Mar 22, 2011 at 09:01:33AM +0900, Simon Horman wrote:
On Tue, Mar 22, 2011 at 08:29:21AM +0900, Simon Horman wrote:
quoted
On Tue, Mar 22, 2011 at 07:13:58AM +0900, Simon Horman wrote:
quoted
On Mon, Mar 21, 2011 at 09:15:40PM +0100, Eric Dumazet wrote:
quoted
Le lundi 21 mars 2011 à 19:07 +0100, Eric Dumazet a écrit :
quoted
Le lundi 21 mars 2011 à 18:39 +0100, Ingo Molnar a écrit :
quoted
here's the same but with kallsyms enabled.
Thanks,
Ingo
[ 9.585627] initcall 0xffffffff81d5b806 returned 0 after 0 usecs
[ 9.588960] calling 0xffffffff81d5b9da @ 1
[ 9.592303] IPVS: Creating netns size=1272 id=0
[ 9.595646] IPVS: __ip_vs_control_init(): alloc_percpu.
[ 9.602298] IPVS: cannot register namespace.
[ 9.605627] IPVS: can't setup control
It seems IPVS is busted in case of memory allocation error in
__ip_vs_control_init()
IPVS deinits its "struct netns_ipvs" space, but something (in IPVS) uses
it after free.
__ip_vs_init() seems to be called before ip_vs_init() completes
correctly. We then keep in net->ipvs a pointer to some freed memory.
Commit 14e405461e664b7 did some changes in this area
Simon, any idea ?
For the time being, we can avoid the false memory allocation error (and
leak)
It seems that the problem above was introduced by
ab8a5e8408c3 ("IPVS: netns awareness to ip_vs_app").
I assume the hungs are the cause:
s/hungs/hunks below/
I am a little unsure of what to do about this.
The problem seems to be that ipvs->app_key is not in static storage.
But I'm not sure how to resolve that given that the struct netns_ipvs is
per-network namespace. So I guess that the locking needs to be re-worked.
Again, I'm a little unsure of what the best way forward is.
@@ -43,11 +43,6 @@ EXPORT_SYMBOL(register_ip_vs_app);EXPORT_SYMBOL(unregister_ip_vs_app);EXPORT_SYMBOL(register_ip_vs_app_inc);-/* ipvs application list head */-staticLIST_HEAD(ip_vs_app_list);-staticDEFINE_MUTEX(__ip_vs_app_mutex);--/**Getanip_vs_appobject*/
net/appletalk: fix atalk_release use after free
The BKL removal in appletalk introduced a use-after-free problem,
where atalk_destroy_socket frees a sock, but we still release
the socket lock on it.
An easy fix is to take an extra reference on the sock and sock_put
it when returning from atalk_release.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
From: Simon Horman <horms@verge.net.au> Date: 2011-03-22 01:18:10
On Tue, Mar 22, 2011 at 09:17:07AM +0900, Simon Horman wrote:
On Tue, Mar 22, 2011 at 09:01:33AM +0900, Simon Horman wrote:
quoted
On Tue, Mar 22, 2011 at 08:29:21AM +0900, Simon Horman wrote:
quoted
On Tue, Mar 22, 2011 at 07:13:58AM +0900, Simon Horman wrote:
quoted
On Mon, Mar 21, 2011 at 09:15:40PM +0100, Eric Dumazet wrote:
quoted
Le lundi 21 mars 2011 à 19:07 +0100, Eric Dumazet a écrit :
quoted
Le lundi 21 mars 2011 à 18:39 +0100, Ingo Molnar a écrit :
quoted
here's the same but with kallsyms enabled.
Thanks,
Ingo
[ 9.585627] initcall 0xffffffff81d5b806 returned 0 after 0 usecs
[ 9.588960] calling 0xffffffff81d5b9da @ 1
[ 9.592303] IPVS: Creating netns size=1272 id=0
[ 9.595646] IPVS: __ip_vs_control_init(): alloc_percpu.
[ 9.602298] IPVS: cannot register namespace.
[ 9.605627] IPVS: can't setup control
It seems IPVS is busted in case of memory allocation error in
__ip_vs_control_init()
IPVS deinits its "struct netns_ipvs" space, but something (in IPVS) uses
it after free.
__ip_vs_init() seems to be called before ip_vs_init() completes
correctly. We then keep in net->ipvs a pointer to some freed memory.
Commit 14e405461e664b7 did some changes in this area
Simon, any idea ?
For the time being, we can avoid the false memory allocation error (and
leak)
It seems that the problem above was introduced by
ab8a5e8408c3 ("IPVS: netns awareness to ip_vs_app").
I assume the hungs are the cause:
s/hungs/hunks below/
I am a little unsure of what to do about this.
The problem seems to be that ipvs->app_key is not in static storage.
But I'm not sure how to resolve that given that the struct netns_ipvs is
per-network namespace. So I guess that the locking needs to be re-worked.
Again, I'm a little unsure of what the best way forward is.
I had an idea for a fix over breakfast.
IPVS: Use global mutex in ip_vs_app.c
As part of the work to make IPVS network namespace aware
__ip_vs_app_mutex was replaced by a per-namespace lock,
ipvs->app_mutex. ipvs->app_key is also supplied for debugging purposes.
Unfortunately this implementation results in ipvs->app_key residing
in non-static storage which at the very least causes a lockdep warning.
This patch takes the rather heavy-handed approach of reinstating
__ip_vs_app_mutex which will cover access to the ipvs->list_head
of all network namespaces.
[ 12.610000] IPVS: Creating netns size=2456 id=0
[ 12.630000] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[ 12.640000] BUG: key ffff880003bbf1a0 not in .data!
[ 12.640000] ------------[ cut here ]------------
[ 12.640000] WARNING: at kernel/lockdep.c:2701 lockdep_init_map+0x37b/0x570()
[ 12.640000] Hardware name: Bochs
[ 12.640000] Pid: 1, comm: swapper Tainted: G W 2.6.38-kexec-06330-g69b7efe-dirty #122
[ 12.650000] Call Trace:
[ 12.650000] [<ffffffff8102e685>] warn_slowpath_common+0x75/0xb0
[ 12.650000] [<ffffffff8102e6d5>] warn_slowpath_null+0x15/0x20
[ 12.650000] [<ffffffff8105967b>] lockdep_init_map+0x37b/0x570
[ 12.650000] [<ffffffff8105829d>] ? trace_hardirqs_on+0xd/0x10
[ 12.650000] [<ffffffff81055ad8>] debug_mutex_init+0x38/0x50
[ 12.650000] [<ffffffff8104bc4c>] __mutex_init+0x5c/0x70
[ 12.650000] [<ffffffff81685ee7>] __ip_vs_app_init+0x64/0x86
[ 12.660000] [<ffffffff81685a3b>] ? ip_vs_init+0x0/0xff
[ 12.660000] [<ffffffff811b1c33>] T.620+0x43/0x170
[ 12.660000] [<ffffffff811b1e9a>] ? register_pernet_subsys+0x1a/0x40
[ 12.660000] [<ffffffff81685a3b>] ? ip_vs_init+0x0/0xff
[ 12.660000] [<ffffffff81685a3b>] ? ip_vs_init+0x0/0xff
[ 12.660000] [<ffffffff811b1db7>] register_pernet_operations+0x57/0xb0
[ 12.660000] [<ffffffff81685a3b>] ? ip_vs_init+0x0/0xff
[ 12.670000] [<ffffffff811b1ea9>] register_pernet_subsys+0x29/0x40
[ 12.670000] [<ffffffff81685f19>] ip_vs_app_init+0x10/0x12
[ 12.670000] [<ffffffff81685a87>] ip_vs_init+0x4c/0xff
[ 12.670000] [<ffffffff8166562c>] do_one_initcall+0x7a/0x12e
[ 12.670000] [<ffffffff8166583e>] kernel_init+0x13e/0x1c2
[ 12.670000] [<ffffffff8128c134>] kernel_thread_helper+0x4/0x10
[ 12.670000] [<ffffffff8128ad40>] ? restore_args+0x0/0x30
[ 12.680000] [<ffffffff81665700>] ? kernel_init+0x0/0x1c2
[ 12.680000] [<ffffffff8128c130>] ? kernel_thread_helper+0x0/0x1global0
Signed-off-by: Simon Horman <horms@verge.net.au>
Cc: Ingo Molnar <redacted>
Cc: Eric Dumazet <redacted>
Cc: Julian Anastasov <ja@ssi.bg>
Cc: Hans Schillstrom <redacted>
---
include/net/ip_vs.h | 2 --
net/netfilter/ipvs/ip_vs_app.c | 23 ++++++++++-------------
2 files changed, 10 insertions(+), 15 deletions(-)
@@ -189,11 +190,11 @@ int register_ip_vs_app(struct net *net, struct ip_vs_app *app)/* increase the module use count */ip_vs_use_count_inc();-mutex_lock(&ipvs->app_mutex);+mutex_lock(&__ip_vs_app_mutex);list_add(&app->a_list,&ipvs->app_list);-mutex_unlock(&ipvs->app_mutex);+mutex_unlock(&__ip_vs_app_mutex);return0;}
@@ -205,10 +206,9 @@ int register_ip_vs_app(struct net *net, struct ip_vs_app *app)*/voidunregister_ip_vs_app(structnet*net,structip_vs_app*app){-structnetns_ipvs*ipvs=net_ipvs(net);structip_vs_app*inc,*nxt;-mutex_lock(&ipvs->app_mutex);+mutex_lock(&__ip_vs_app_mutex);list_for_each_entry_safe(inc,nxt,&app->incs_list,a_list){ip_vs_app_inc_release(net,inc);
@@ -216,7 +216,7 @@ void unregister_ip_vs_app(struct net *net, struct ip_vs_app *app)list_del(&app->a_list);-mutex_unlock(&ipvs->app_mutex);+mutex_unlock(&__ip_vs_app_mutex);/* decrease the module use count */ip_vs_use_count_dec();
@@ -583,7 +581,6 @@ static int __net_init __ip_vs_app_init(struct net *net)structnetns_ipvs*ipvs=net_ipvs(net);INIT_LIST_HEAD(&ipvs->app_list);-__mutex_init(&ipvs->app_mutex,"ipvs->app_mutex",&ipvs->app_key);proc_net_fops_create(net,"ip_vs_app",0,&ip_vs_app_fops);return0;}
From: David Miller <davem@davemloft.net> Date: 2011-03-22 03:39:41
From: Simon Horman <horms@verge.net.au>
Date: Tue, 22 Mar 2011 10:18:01 +0900
IPVS: Use global mutex in ip_vs_app.c
As part of the work to make IPVS network namespace aware
__ip_vs_app_mutex was replaced by a per-namespace lock,
ipvs->app_mutex. ipvs->app_key is also supplied for debugging purposes.
Unfortunately this implementation results in ipvs->app_key residing
in non-static storage which at the very least causes a lockdep warning.
This patch takes the rather heavy-handed approach of reinstating
__ip_vs_app_mutex which will cover access to the ipvs->list_head
of all network namespaces.
That said, I'm delaying this pull request due to the known issues with
it - let me know when you've updated it with the fix for the
use-after-free fixes and the slab corruptor (the latter of which I
haven't seen a patch for yet)
I've intergrated several bug fixes, including those for all of the
problems Ingo reported:
1) Non-netlink ipsec configurations fail to initialize
replay info, resulting in OOPS. Fix from Wei Yongjun.
2) L2TP marks l2tp_eth_net_ops as __net_initdata causing OOPS
on module unload, fix from James Chapman.
3) lock_kernel removal regression fixes from Eric Dumazet and
Arnd Bergmann. Both IPX and Appletalk could release a socket
while holding that socket's lock.
4) C_CAN driver enables interrupts before chip is actually ready,
fix from Jan Altenberg.
5) Use after free in macvlan, fix from Eric W. Biederman.
6) ipv6 creates dup "neigh" sysfs directories, also from Eric
W. Biederman.
7) VETH over-increments TX/RX byte counters, also from Eric
W. Biederman.
8) Two IPVS bug fixes:
a) Reverse NULL check after allocation, from Eric Dumazet.
b) mutex lockdep key invalidly in dynamic memory, fix from
Simon Horman.
Please pull, thanks a lot:
The following changes since commit a44f99c7efdb88fa41128065c9a9445c19894e34:
Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 (2011-03-20 18:14:55 -0700)
are available in the git repository at:
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6.git master
Alex Dubov (1):
gianfar: Fall back to software tcp/udp checksum on older controllers
Arnd Bergmann (1):
net/appletalk: fix atalk_release use after free
Ben Hutchings (1):
ethtool: Compat handling for struct ethtool_rxnfc
Dan Carpenter (1):
ftmac100: use resource_size()
David S. Miller (3):
niu: Rename NIU parent platform device name to fix conflict.
Merge branch 'master' of git://git.kernel.org/.../kaber/nf-2.6
Merge branch 'vhost-net-next' of git://git.kernel.org/.../mst/vhost
Eric Dumazet (6):
vlan: should take into account needed_headroom
r8169: fix a bug in rtl8169_init_phy()
netfilter: xtables: fix reentrancy
snmp: SNMP_UPD_PO_STATS_BH() always called from softirq
ipx: fix ipx_release()
ipvs: fix a typo in __ip_vs_control_init()
Eric W. Biederman (3):
macvlan: Fix use after free of struct macvlan_port.
net ipv6: Fix duplicate /proc/sys/net/ipv6/neigh directory entries.
veth: Fix the byte counters
Herbert Xu (1):
bridge: Reset IPCB when entering IP stack on NF_FORWARD
James Chapman (1):
l2tp: fix possible oops on l2tp_eth module unload
Jan Altenberg (1):
can: c_can: Do basic c_can configuration _before_ enabling the interrupts
Jason Wang (3):
vhost-net: check the support of mergeable buffer outside the receive loop
vhost-net: Unify the code of mergeable and big buffer handling
vhost: lock receive queue, not the socket
Jozsef Kadlecsik (2):
netfilter: ipset: fix address ranges at hash:*port* types
netfilter: ipset: fix checking the type revision at create command
Krishna Kumar (1):
vhost: Cleanup vhost.c and net.c
Michael S. Tsirkin (2):
vhost: copy_from_user -> __copy_from_user
vhost-net: remove unlocked use of receive_queue
Mike Frysinger (1):
headers: use __aligned_xx types for userspace
Neil Horman (1):
net: fix incorrect spelling in drop monitor protocol
Nicolas de Pesloüan (1):
bonding: fix a typo in a comment
Roger Luethi (1):
ethtool: __ethtool_set_sg: check for function pointer before using it
Simon Horman (1):
IPVS: Use global mutex in ip_vs_app.c
Vasiliy Kulikov (2):
econet: 4 byte infoleak to the network
netfilter: ipt_CLUSTERIP: fix buffer overflow
Wei Yongjun (1):
xfrm: Fix initialize repl field of struct xfrm_state
drivers/net/bonding/bond_main.c | 2 +-
drivers/net/can/c_can/c_can.c | 6 +-
drivers/net/ftmac100.c | 2 +-
drivers/net/gianfar.c | 16 ++-
drivers/net/gianfar.h | 1 +
drivers/net/macvlan.c | 18 ++-
drivers/net/niu.c | 2 +-
drivers/net/r8169.c | 4 +-
drivers/net/veth.c | 2 +-
drivers/vhost/net.c | 159 ++++--------------------
drivers/vhost/vhost.c | 55 ++++++---
include/linux/ethtool.h | 34 +++++
include/linux/if_ppp.h | 16 ++--
include/linux/netfilter/ipset/ip_set_getport.h | 10 ++
include/linux/netfilter/nfnetlink_log.h | 4 +-
include/linux/netfilter/nfnetlink_queue.h | 4 +-
include/linux/netfilter/xt_connbytes.h | 4 +-
include/linux/netfilter/xt_quota.h | 2 +-
include/net/ip_vs.h | 2 -
include/net/snmp.h | 4 +-
include/net/xfrm.h | 1 +
net/8021q/vlan_dev.c | 1 +
net/appletalk/ddp.c | 3 +
net/bridge/br_netfilter.c | 3 +
net/core/drop_monitor.c | 2 +-
net/core/ethtool.c | 3 +
net/econet/af_econet.c | 2 +-
net/ipv4/netfilter/ip_tables.c | 4 +-
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +-
net/ipv6/netfilter/ip6_tables.c | 4 +-
net/ipv6/sysctl_net_ipv6.c | 18 ++-
net/ipx/af_ipx.c | 2 +-
net/l2tp/l2tp_eth.c | 2 +-
net/netfilter/ipset/ip_set_core.c | 22 +++-
net/netfilter/ipset/ip_set_hash_ipport.c | 34 ++----
net/netfilter/ipset/ip_set_hash_ipportip.c | 34 ++----
net/netfilter/ipset/ip_set_hash_ipportnet.c | 34 ++----
net/netfilter/ipset/ip_set_hash_netport.c | 30 ++----
net/netfilter/ipvs/ip_vs_app.c | 23 ++--
net/netfilter/ipvs/ip_vs_ctl.c | 2 +-
net/socket.c | 114 ++++++++++++++++-
net/xfrm/xfrm_state.c | 15 ++-
net/xfrm/xfrm_user.c | 2 +-
43 files changed, 383 insertions(+), 324 deletions(-)
On Sun, Mar 20, 2011 at 7:51 PM, David Miller [off-list ref] wrote:
quoted
1) The R8169 PHY fix from Eric Dumazet, which I see you've added to
your tree too. :-)
Yeah, since my machine didn't have networking without it, and I could
test it myself, I didn't wait to pull.
That said, I'm delaying this pull request due to the known issues with
it - let me know when you've updated it with the fix for the
use-after-free fixes and the slab corruptor (the latter of which I
haven't seen a patch for yet)
All problems i was able to trigger in this area are fixed by these patches:
ipvs: Fix a typo in __ip_vs_control_init()
IPVS: Use global mutex in ip_vs_app.c
ipx: Fix ipx_release()
net/appletalk: fix atalk_release use after free
Thanks,
Ingo